Universal Plug and Play (UPnP) is an industry effort to evolve technology for easy setup and easy establishment of connectivity of home and enterprise computer equipment. The UPnP standard enables devices such as personal computers (PCs), computer peripherals, routers, printers, storage devices, set-top boxes, televisions, and mobile phones to automatically discover each other, connect, and interoperate seamlessly. UPnP is also one of the enabling technologies for the Digital Living Network Alliance (DLNA), which endeavors to enable the digital convergence of devices in home and enterprise networks. UPnP is a fundamental building block of the DLNA specification, which may be currently considered a de facto standard for home network interoperability.
In UPnP, components are conventionally categorized as devices or control points (CPs). A device contains services. A control point is able to discover devices, and is able to control the services offered by the devices (e.g., by using Remote Procedure Call within Simple Object Access Protocol). A service, among other capabilities, is able to receive action requests from a control point, and perform the requested actions. Thus, a control point is able to invoke actions associated with the devices. In an illustrative example, a UPnP-compliant videocassette recorder (VCR) device may host a VCR service, and the VCR service may be associated with actions such as play, stop, pause, rewind and fast-forward.
In a conventional UPnP security specification, a network may include a third type of UPnP component, a security console, that is both a device and a control point. A security console can be used to set up ACLs in devices. In order to set up security in a UPnP network, all control points and devices must be made known to the security console. A security console acts as a control point to discover devices in a network, and acts as a device (e.g., by exposing a special security console service) in order to be discoverable by control points. The security console can take ownership of devices, and then create an Access Control List (ACL) for the device, in which restricted access is explicitly given to control points.
Conventional UPnP devices are able to enforce access control based on the use of ACLs. An ACL is used within a device to control access rights to services or to actions, and thus to control what actions may be invoked by a control point. For a particular device, each of the entries in the device's ACL identifies what a subject (e.g., a uniquely identified control point, or a specified group of control points) is allowed to do on the device, and whether the CP or group of CPs can further delegate those rights to other CPs. Delegation is the act by which a CP is able to grant a right that it has to another CP. A variety of delegation capabilities are available in conventional UPnP devices via the use of authorization certificates.